[GitHub] rnewson commented on a change in pull request #1440: Optionally prevent non-admins from accessing /_all_dbs

[GitBox <gi...@apache.org>]

rnewson commented on a change in pull request #1440: Optionally prevent non-admins from accessing /_all_dbs
URL: https://github.com/apache/couchdb/pull/1440#discussion_r202514372
 
 

 ##########
 File path: src/chttpd/src/chttpd_auth_request.erl
 ##########
 @@ -34,7 +34,10 @@ authorize_request_int(#httpd{path_parts=[]}=Req) ->
 authorize_request_int(#httpd{path_parts=[<<"favicon.ico">>|_]}=Req) ->
     Req;
 authorize_request_int(#httpd{path_parts=[<<"_all_dbs">>|_]}=Req) ->
-    Req;
+   case config:get("chttpd", "admin_only_all_dbs", "false") of
+       "false" -> Req;
+       _Else -> require_admin(Req)
 
 Review comment:
   I'd rather that "true" was required for this explicitly.

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services